RE: "Selling" a code-audit.
"Calderon, Juan Carlos (GE Commercial Finance, NonGE)" <[email protected]> Wed, 1 Sep 2004 17:39:29 -0400
| Newsgroups | gmane.comp.security.programming |
|---|---|
| Message-ID | <999169B0CC0F2A418615C28851C5C0710789086E@CINMLVEM09.e2k.ad.ge.com> |
Hi Yvan I'm a code autor as well. Usually a code audit is like bad news for developes this is why they take this defensive posture. Is like "a who-knows guy will tell me why I wrote my code in the bad way and how should I codify". From my point of view, you have to "prepare the field" for the meetings and get a list of good coding practices or good solutions in some modules, after all is almost impossible the code was wrong in all ways and viceverza. So let them know this and let them know they do some things good, BUT they did as well some things bad that need their attention and correction. Even doing this some people will still be pessimist/nasty (after all, that "innecesary" code audit make them work after hours), but it will be dimished. Just my two cents -Juan C Calderon -----Original Message----- From: Yvan Boily [mailto:[email protected]] Sent: Lunes, 30 de Agosto de 2004 12:45 p.m. To: [email protected] Subject: "Selling" a code-audit. One of my primary responsibilities with my employer is performing code audits; so far I have been fairly effective in a technical capacity, however on almost every single code audit I have participated in I have received hostile responses from the development team. I have tried a variety of approaches to develop a stronger rapport with the development team, however in spite of my best efforts I find that going into a code audit I am already fighting against preconceptions about why the code audit is being performed. I understand that many people feel threatened when work they have done is criticized; what I need to know is how I can minimize this and coax the development teams into being more interactive than defensive. Any pointers? Yvan Boily